Hi, I downloaded (installed via Splunk GUI) and am testing out the GeoIP app on my 4.1.4 search head. I'm having an issue though. When I run a search against my proxy data I get no returned information from the GeoIP lookups. The search command I'm running is:
index=weblog | lookup geoip clientip as ip
I do know that after downloading the app I restarted Splunk. I get no errors in logs or at the GUI when I'm issuing the searches.
Any idea on what I'm doing wrong?
This is an expensive (resource) task on my system. In most of my events I will have at least 2 IP addresses that are extracted via CSV field extraction - which give pretty fast field extractions. IPLocation trying to find the IP in the _raw of these events doesn't come across as optimal. Plus iplocation doesn't give me the opportunity to "give" the lookup an IP address.
I use geoip all the time, and I have never had any problems with the expense of the operation.
Try using localop:
index=weblog | localop | lookup geoip clientip as ip
hi @castle1126 - instead of adding a new answer (like you'd do on a traditional forum), on Splunk Answers you'll want to add a comment on the correct answer and "accept" it by clicking the checkmark. Thanks!